January 2023 - Alsa-devel - mailman.alsa-project.org

[PATCH 0/3] Add the Renesas IDT821034 codec support
by Herve Codina 13 Jan '23

13 Jan '23

Hi, The Renesas IDT821034 codec is four channel PCM codec with on-chip filters and programmable gain setting. It also provides SLIC (Subscriber Line Interface Circuit) signals as GPIOs. Best regards, Herve Codina Herve Codina (3): dt-bindings: sound: Add Renesas IDT821034 codec ASoC: codecs: Add support for the Renesas IDT821034 codec MAINTAINERS: add the Renesas IDT821034 codec entry .../bindings/sound/renesas,idt821034.yaml | 97 ++ MAINTAINERS | 7 + sound/soc/codecs/Kconfig | 12 + sound/soc/codecs/Makefile | 2 + sound/soc/codecs/idt821034.c | 1234 +++++++++++++++++ 5 files changed, 1352 insertions(+) create mode 100644 Documentation/devicetree/bindings/sound/renesas,idt821034.yaml create mode 100644 sound/soc/codecs/idt821034.c -- 2.38.1

3 11

[bug report] ALSA: firewire-lib: extend tracepoints event including CYCLE_TIME of 1394 OHCI
by Dan Carpenter 13 Jan '23

13 Jan '23

Hello Takashi Sakamoto, The patch fef4e61b0b76: "ALSA: firewire-lib: extend tracepoints event including CYCLE_TIME of 1394 OHCI" from Jan 10, 2023, leads to the following Smatch static checker warning: sound/firewire/amdtp-stream.c:944 generate_tx_packet_descs() error: uninitialized symbol 'curr_cycle_time'. sound/firewire/amdtp-stream.c:1099 process_rx_packets() error: uninitialized symbol 'curr_cycle_time'. sound/firewire/amdtp-stream.c 1047 static void process_rx_packets(struct fw_iso_context *context, u32 tstamp, size_t header_length, 1048 void *header, void *private_data) 1049 { 1050 struct amdtp_stream *s = private_data; 1051 const struct amdtp_domain *d = s->domain; 1052 const __be32 *ctx_header = header; 1053 const unsigned int events_per_period = d->events_per_period; 1054 unsigned int event_count = s->ctx_data.rx.event_count; 1055 struct pkt_desc *desc = s->packet_descs_cursor; 1056 unsigned int pkt_header_length; 1057 unsigned int packets; 1058 u32 curr_cycle_time; ^^^^^^^^^^^^^^^^^^^ 1059 bool need_hw_irq; 1060 int i; 1061 1062 if (s->packet_index < 0) 1063 return; 1064 1065 // Calculate the number of packets in buffer and check XRUN. 1066 packets = header_length / sizeof(*ctx_header); 1067 1068 generate_rx_packet_descs(s, desc, ctx_header, packets); 1069 1070 process_ctx_payloads(s, desc, packets); 1071 1072 if (!(s->flags & CIP_NO_HEADER)) 1073 pkt_header_length = IT_PKT_HEADER_SIZE_CIP; 1074 else 1075 pkt_header_length = 0; 1076 1077 if (s == d->irq_target) { 1078 // At NO_PERIOD_WAKEUP mode, the packets for all IT/IR contexts are processed by 1079 // the tasks of user process operating ALSA PCM character device by calling ioctl(2) 1080 // with some requests, instead of scheduled hardware IRQ of an IT context. 1081 struct snd_pcm_substream *pcm = READ_ONCE(s->pcm); 1082 need_hw_irq = !pcm || !pcm->runtime->no_period_wakeup; 1083 } else { 1084 need_hw_irq = false; 1085 } 1086 1087 if (trace_amdtp_packet_enabled()) 1088 (void)fw_card_read_cycle_time(fw_parent_device(s->unit)->card, &curr_cycle_time); No error checking and no else path. 1089 1090 for (i = 0; i < packets; ++i) { 1091 struct { 1092 struct fw_iso_packet params; 1093 __be32 header[CIP_HEADER_QUADLETS]; 1094 } template = { {0}, {0} }; 1095 bool sched_irq = false; 1096 1097 build_it_pkt_header(s, desc->cycle, &template.params, pkt_header_length, 1098 desc->data_blocks, desc->data_block_counter, --> 1099 desc->syt, i, curr_cycle_time); ^^^^^^^^^^^^^^^ Uninitialized. 1100 1101 if (s == s->domain->irq_target) { 1102 event_count += desc->data_blocks; 1103 if (event_count >= events_per_period) { 1104 event_count -= events_per_period; 1105 sched_irq = need_hw_irq; 1106 } 1107 } 1108 1109 if (queue_out_packet(s, &template.params, sched_irq) < 0) { 1110 cancel_stream(s); 1111 return; 1112 } 1113 1114 desc = amdtp_stream_next_packet_desc(s, desc); 1115 } 1116 1117 s->ctx_data.rx.event_count = event_count; 1118 s->packet_descs_cursor = desc; 1119 } regards, dan carpenter

2 1

[PATCH] ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF
by Takashi Iwai 13 Jan '23

13 Jan '23

From: Clement Lecigne <clecigne(a)google.com> Takes rwsem lock inside snd_ctl_elem_read instead of snd_ctl_elem_read_user like it was done for write in commit 1fa4445f9adf1 ("ALSA: control - introduce snd_ctl_notify_one() helper"). Doing this way we are also fixing the following locking issue happening in the compat path which can be easily triggered and turned into an use-after-free. 64-bits: snd_ctl_ioctl snd_ctl_elem_read_user [takes controls_rwsem] snd_ctl_elem_read [lock properly held, all good] [drops controls_rwsem] 32-bits: snd_ctl_ioctl_compat snd_ctl_elem_write_read_compat ctl_elem_write_read snd_ctl_elem_read [missing lock, not good] CVE-2023-0266 was assigned for this issue. Cc: stable(a)kernel.org # 5.13+ Signed-off-by: Clement Lecigne <clecigne(a)google.com> Signed-off-by: Takashi Iwai <tiwai(a)suse.de> --- Note: the fixes for older stable trees will be submitted in another patch sound/core/control.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/sound/core/control.c b/sound/core/control.c index 50e7ba66f187..82aa1af1d1d8 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -1203,14 +1203,19 @@ static int snd_ctl_elem_read(struct snd_card *card, const u32 pattern = 0xdeadbeef; int ret; + down_read(&card->controls_rwsem); kctl = snd_ctl_find_id(card, &control->id); - if (kctl == NULL) - return -ENOENT; + if (kctl == NULL) { + ret = -ENOENT; + goto unlock; + } index_offset = snd_ctl_get_ioff(kctl, &control->id); vd = &kctl->vd[index_offset]; - if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || kctl->get == NULL) - return -EPERM; + if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || kctl->get == NULL) { + ret = -EPERM; + goto unlock; + } snd_ctl_build_ioff(&control->id, kctl, index_offset); @@ -1220,7 +1225,7 @@ static int snd_ctl_elem_read(struct snd_card *card, info.id = control->id; ret = __snd_ctl_elem_info(card, kctl, &info, NULL); if (ret < 0) - return ret; + goto unlock; #endif if (!snd_ctl_skip_validation(&info)) @@ -1230,7 +1235,7 @@ static int snd_ctl_elem_read(struct snd_card *card, ret = kctl->get(kctl, control); snd_power_unref(card); if (ret < 0) - return ret; + goto unlock; if (!snd_ctl_skip_validation(&info) && sanity_check_elem_value(card, control, &info, pattern) < 0) { dev_err(card->dev, @@ -1238,8 +1243,11 @@ static int snd_ctl_elem_read(struct snd_card *card, control->id.iface, control->id.device, control->id.subdevice, control->id.name, control->id.index); - return -EINVAL; + ret = -EINVAL; + goto unlock; } +unlock: + up_read(&card->controls_rwsem); return ret; } @@ -1253,9 +1261,7 @@ static int snd_ctl_elem_read_user(struct snd_card *card, if (IS_ERR(control)) return PTR_ERR(control); - down_read(&card->controls_rwsem); result = snd_ctl_elem_read(card, control); - up_read(&card->controls_rwsem); if (result < 0) goto error; -- 2.35.3

2 1

question about byte alignment (snd_pcm_hw_constraint_msbits and SNDRV_PCM_FMTBIT_S32_LE)
by Gagan Sidhu 13 Jan '23

13 Jan '23

1 0

[PATCH v2 0/5] ASoC: samsung: fsd: audio support for FSD SoC
by Padmanabhan Rajanbabu 13 Jan '23

13 Jan '23

The intention of this patch series is to enable audio support on FSD SoC. Changes in v2: 1. New compatible added in Exynos I2S driver for FSD platform. 2. Added Fixup support for Exynos I2S CPU DAI. 3. Migration of manual PSR, OPCLK configuration to Exynos CPU DAI driver as fixup. 4. Migrated from dedicated sound card to simple audio card. 5. Support added for tlv320aic3x-i2c codec on FSD platform. Changes in v1: 1. Add TDM support on samsung I2S interface. 2. Allow sound card to directly configure I2S prescaler divider instead of calculating it from frame clock. 3. The sound card support for FSD SoC which utilizes samsung I2S interface as CPU DAI. Padmanabhan Rajanbabu (5): ASoC: samsung-i2s: add FSD compatibile string ASoC: samsung: i2s: add support for FSD I2S arm64: dts: fsd: Add I2S DAI node for Tesla FSD arm64: dts: fsd: Add codec node for Tesla FSD arm64: dts: fsd: Add sound card node for Tesla FSD .../bindings/sound/samsung-i2s.yaml | 4 ++ arch/arm64/boot/dts/tesla/fsd-evb.dts | 59 +++++++++++++++++++ arch/arm64/boot/dts/tesla/fsd-pinctrl.dtsi | 14 +++++ arch/arm64/boot/dts/tesla/fsd.dtsi | 34 +++++++++++ sound/soc/samsung/i2s.c | 57 ++++++++++++++++++ 5 files changed, 168 insertions(+) -- 2.17.1

4 19

[PATCH 0/6] ALSA: fireface: support knob control event for Fireface 400
by Takashi Sakamoto 13 Jan '23

13 Jan '23

Hi, Fireface 400 uses asynchronous transaction mechanism to deliver event of hardware knob control as well as received MIDI messages. Current implementation doesn't distinguish them, thus all arrived messages are processed for MIDI message. This patchset adds the parser to distinguish them, and deliver knob control event to user space via ALSA hwdep character device. The implementation works well as long as I tested with the patches for libhitaki library: https://github.com/alsa-project/libhitaki/tree/topic/ff/400-msg I note that Fireface 400 transmits no asynchronous transaction when it is not configured by block write transaction to offset 0x000080100514, which turn off HOST led from red. Takashi Sakamoto (6): ALSA: fireface: rename callback functions ALSA: fireface: pick up time stamp for request subaction of asynchronous transaction ALSA: fireface: add helper function to parse MIDI messages transmitted by Fireface 400 ALSA: fireface: update UAPI for data of knob control ALSA: fireface: add local framework to message parser ALSA: fireface: implement message parser for Fireface 400 include/uapi/sound/firewire.h | 24 +++ sound/firewire/fireface/ff-hwdep.c | 41 ++-- sound/firewire/fireface/ff-protocol-former.c | 186 +++++++++++++++---- sound/firewire/fireface/ff-protocol-latter.c | 6 +- sound/firewire/fireface/ff-transaction.c | 17 +- sound/firewire/fireface/ff.c | 10 + sound/firewire/fireface/ff.h | 9 +- 7 files changed, 239 insertions(+), 54 deletions(-) -- 2.37.2

2 7

[PATCH] ALSA: usb-audio: Fix possible NULL pointer dereference in snd_usb_pcm_has_fixed_rate()
by Jaroslav Kysela 13 Jan '23

13 Jan '23

The subs function argument may be NULL, so do not use it before the NULL check. Fixes: 291e9da91403 ("ALSA: usb-audio: Always initialize fixed_rate in snd_usb_find_implicit_fb_sync_format()") Reported-by: coverity-bot <keescook(a)chromium.org> Link: https://lore.kernel.org/alsa-devel/202301121424.4A79A485@keescook/ Signed-off-by: Jaroslav Kysela <perex(a)perex.cz> --- sound/usb/pcm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c index 1f72960d0d53..d959da7a1afb 100644 --- a/sound/usb/pcm.c +++ b/sound/usb/pcm.c @@ -160,11 +160,12 @@ find_substream_format(struct snd_usb_substream *subs, bool snd_usb_pcm_has_fixed_rate(struct snd_usb_substream *subs) { const struct audioformat *fp; - struct snd_usb_audio *chip = subs->stream->chip; + struct snd_usb_audio *chip; int rate = -1; if (!subs) return false; + chip = subs->stream->chip; if (!(chip->quirk_flags & QUIRK_FLAG_FIXED_RATE)) return false; list_for_each_entry(fp, &subs->fmt_list, list) { -- 2.39.0

2 1

[PATCH] Support for MAX98090/91 codec in iMX8MM evk
by Hardevsinh Palaniya 13 Jan '23

13 Jan '23

From: Hardevsinh Palaniya <hardevsinh.palaniya(a)siliconsignals.io> Date: Sat, 7 Jan 2023 17:08:28 +0530 Subject: [PATCH] Support for MAX98090/91 codec in iMX8MM evk - Adding node for MAX98090/91 in dts imx8mm-evk.dtsi - Adding tristate option in <sound/soc/codecs/Kconfig> Signed-off-by: Hardevsinh Palaniya <hardevsinh.palaniya(a)siliconsignals.io> diff --git a/arch/arm64/boot/dts/freescale/imx8mm-evk.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-evk.dtsi index e0b604ac0da4..58ff63cbc930 100644 --- a/arch/arm64/boot/dts/freescale/imx8mm-evk.dtsi +++ b/arch/arm64/boot/dts/freescale/imx8mm-evk.dtsi @@ -132,6 +132,32 @@ simple-audio-card,codec { clocks = <&clk IMX8MM_CLK_SAI3_ROOT>; }; }; + + sound-max98090 { + compatible = "simple-audio-card"; + simple-audio-card,name = "max98090-audio"; + simple-audio-card,format = "i2s"; + simple-audio-card,frame-master = <&cpudai>; + simple-audio-card,bitclock-master = <&cpudai>; + simple-audio-card,widgets = "Speakers", "Speakers"; + simple-audio-card,routing = + "Speakers", "SPKR", + "Speakers", "SPKL", + "IN1", "MICBIAS", + "MIC1","IN1", + "MIC2","IN1"; + + cpudai: simple-audio-card,cpu { + sound-dai = <&sai5>; + dai-tdm-slot-num = <2>; + dai-tdm-slot-width = <32>; + }; + + simple-audio-card,codec { + sound-dai = <&max98090>; + clocks = <&clk IMX8MM_CLK_SAI5_ROOT>; + }; + }; }; &A53_0 { @@ -339,6 +365,14 @@ &i2c3 { pinctrl-0 = <&pinctrl_i2c3>; status = "okay"; + max98090: max98090@10 { + #sound-dai-cells = <0>; + compatible = "maxim,max98090"; + reg = <0x10>; + clocks = <&clk IMX8MM_CLK_SAI5_ROOT>; + clock-names = "mclk"; + }; + pca6416: gpio@20 { compatible = "ti,tca6416"; reg = <0x20>; @@ -391,6 +425,20 @@ &sai3 { status = "okay"; }; +&sai5 { + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_sai5>; + assigned-clocks = <&clk IMX8MM_CLK_SAI5>; + assigned-clock-parents = <&clk IMX8MM_AUDIO_PLL1_OUT>; + assigned-clock-rates = <24576000>; + clocks = <&clk IMX8MM_CLK_SAI5_IPG>, <&clk IMX8MM_CLK_DUMMY>, + <&clk IMX8MM_CLK_SAI5_ROOT>, <&clk IMX8MM_CLK_DUMMY>, + <&clk IMX8MM_CLK_DUMMY>, <&clk IMX8MM_AUDIO_PLL1_OUT>, + <&clk IMX8MM_AUDIO_PLL2_OUT>; + clock-names = "bus", "mclk0", "mclk1", "mclk2", "mclk3", "pll8k", "pll11k"; + status = "okay"; +}; + &snvs_pwrkey { status = "okay"; }; @@ -552,6 +600,16 @@ MX8MM_IOMUXC_SAI3_TXD_SAI3_TX_DATA0 0xd6 >; }; + pinctrl_sai5: sai5grp { + fsl,pins = < + MX8MM_IOMUXC_SAI5_MCLK_SAI5_MCLK 0xd6 + MX8MM_IOMUXC_SAI5_RXD2_SAI5_TX_BCLK 0xd6 + MX8MM_IOMUXC_SAI5_RXD1_SAI5_TX_SYNC 0xd6 + MX8MM_IOMUXC_SAI5_RXD0_SAI5_RX_DATA0 0xd6 + MX8MM_IOMUXC_SAI5_RXD3_SAI5_TX_DATA0 0xd6 + >; + } + pinctrl_typec1: typec1grp { fsl,pins = < MX8MM_IOMUXC_SD1_STROBE_GPIO2_IO11 0x159 diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig index 0f9d71490075..efef2df362a4 100644 --- a/sound/soc/codecs/Kconfig +++ b/sound/soc/codecs/Kconfig @@ -1009,7 +1009,7 @@ config SND_SOC_MAX98088 depends on I2C config SND_SOC_MAX98090 - tristate + tristate "Maxim MAX98090/1, Stereo Audio Codec" depends on I2C config SND_SOC_MAX98095 -- 2.25.1

3 6

[syzbot] KASAN: use-after-free Read in snd_pcm_post_stop
by syzbot 13 Jan '23

13 Jan '23

Hello, syzbot found the following issue on: HEAD commit: 0a093b2893c7 Add linux-next specific files for 20230112 git tree: linux-next console+strace: https://syzkaller.appspot.com/x/log.txt?x=123b545e480000 kernel config: https://syzkaller.appspot.com/x/.config?x=835f3591019836d5 dashboard link: https://syzkaller.appspot.com/bug?extid=e29d28728f38190cecfc compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17530902480000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1206692c480000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/8111a570d6cb/disk-0a093b28.raw… vmlinux: https://storage.googleapis.com/syzbot-assets/ecc135b7fc9a/vmlinux-0a093b28.… kernel image: https://storage.googleapis.com/syzbot-assets/ca8d73b446ea/bzImage-0a093b28.… IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+e29d28728f38190cecfc(a)syzkaller.appspotmail.com ================================================================== BUG: KASAN: use-after-free in __wake_up_common+0x637/0x650 kernel/sched/wait.c:100 Read of size 8 at addr ffff88801eb938f0 by task syz-executor234/5078 CPU: 0 PID: 5078 Comm: syz-executor234 Not tainted 6.2.0-rc3-next-20230112-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x15e/0x45d mm/kasan/report.c:417 kasan_report+0xc0/0xf0 mm/kasan/report.c:517 __wake_up_common+0x637/0x650 kernel/sched/wait.c:100 __wake_up_common_lock+0xd4/0x140 kernel/sched/wait.c:138 snd_pcm_post_stop+0x91/0x1f0 sound/core/pcm_native.c:1522 snd_pcm_action_single+0xf4/0x130 sound/core/pcm_native.c:1283 snd_pcm_action+0x6e/0x90 sound/core/pcm_native.c:1364 snd_pcm_stop sound/core/pcm_native.c:1543 [inline] snd_pcm_drop+0x165/0x2b0 sound/core/pcm_native.c:2227 snd_pcm_kernel_ioctl+0x243/0x2e0 sound/core/pcm_native.c:3456 snd_pcm_oss_sync+0x230/0x810 sound/core/oss/pcm_oss.c:1746 snd_pcm_oss_release+0x27a/0x300 sound/core/oss/pcm_oss.c:2590 __fput+0x27c/0xa90 fs/file_table.c:321 task_work_run+0x16f/0x270 kernel/task_work.c:179 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xb17/0x2a90 kernel/exit.c:867 do_group_exit+0xd4/0x2a0 kernel/exit.c:1012 get_signal+0x225f/0x24f0 kernel/signal.c:2859 arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f864105c209 Code: Unable to access opcode bytes at 0x7f864105c1df. RSP: 002b:00007fff6e56b898 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: fffffffffffffe00 RBX: 0000000000000004 RCX: 00007f864105c209 RDX: 0000000000002020 RSI: 00000000200021c0 RDI: 0000000000000006 RBP: 0000000000000000 R08: 00007fff6e56ba38 R09: 00007fff6e56ba38 R10: 000000000000000d R11: 0000000000000246 R12: 00007f864101f800 R13: 431bde82d7b634db R14: 0000000000000000 R15: 0000000000000000 </TASK> Allocated by task 5078: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x7f/0x90 mm/kasan/common.c:325 kasan_slab_alloc include/linux/kasan.h:186 [inline] slab_post_alloc_hook mm/slab.h:769 [inline] kmem_cache_alloc_bulk+0x3aa/0x730 mm/slub.c:4033 __io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1062 io_alloc_req_refill io_uring/io_uring.h:348 [inline] io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2407 __do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3429 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 1002: kasan_save_stack+0x22/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:518 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:162 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1807 slab_free mm/slub.c:3787 [inline] kmem_cache_free+0xec/0x4e0 mm/slub.c:3809 io_req_caches_free+0x1a9/0x1e6 io_uring/io_uring.c:2737 io_ring_exit_work+0x2e7/0xc80 io_uring/io_uring.c:2967 process_one_work+0x9bf/0x1750 kernel/workqueue.c:2293 worker_thread+0x669/0x1090 kernel/workqueue.c:2440 kthread+0x2e8/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 The buggy address belongs to the object at ffff88801eb938c0 which belongs to the cache io_kiocb of size 216 The buggy address is located 48 bytes inside of 216-byte region [ffff88801eb938c0, ffff88801eb93998) The buggy address belongs to the physical page: page:ffffea00007ae4c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eb93 flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 ffff88801bc32dc0 dead000000000122 0000000000000000 raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 5078, tgid 5078 (syz-executor234), ts 58909389529, free_ts 58908987546 prep_new_page mm/page_alloc.c:2549 [inline] get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4324 __alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5590 alloc_pages+0x1aa/0x270 mm/mempolicy.c:2281 alloc_slab_page mm/slub.c:1851 [inline] allocate_slab+0x25f/0x350 mm/slub.c:1998 new_slab mm/slub.c:2051 [inline] ___slab_alloc+0xa91/0x1400 mm/slub.c:3193 __kmem_cache_alloc_bulk mm/slub.c:3951 [inline] kmem_cache_alloc_bulk+0x23d/0x730 mm/slub.c:4026 __io_alloc_req_refill+0xcc/0x40b io_uring/io_uring.c:1062 io_alloc_req_refill io_uring/io_uring.h:348 [inline] io_submit_sqes.cold+0x7c/0xc2 io_uring/io_uring.c:2407 __do_sys_io_uring_enter+0x9e4/0x2c10 io_uring/io_uring.c:3429 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1451 [inline] free_pcp_prepare+0x4d0/0x910 mm/page_alloc.c:1501 free_unref_page_prepare mm/page_alloc.c:3387 [inline] free_unref_page+0x1d/0x490 mm/page_alloc.c:3482 skb_free_frag include/linux/skbuff.h:3193 [inline] skb_free_head+0x96/0x110 net/core/skbuff.c:818 skb_release_data+0x5f4/0x870 net/core/skbuff.c:849 skb_release_all net/core/skbuff.c:914 [inline] __kfree_skb+0x4f/0x70 net/core/skbuff.c:928 tcp_rcv_established+0x15fd/0x2270 net/ipv4/tcp_input.c:5927 tcp_v4_do_rcv+0x663/0x9d0 net/ipv4/tcp_ipv4.c:1721 tcp_v4_rcv+0x2eab/0x3280 net/ipv4/tcp_ipv4.c:2142 ip_protocol_deliver_rcu+0x9f/0x480 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2ec/0x4f0 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:302 [inline] NF_HOOK include/linux/netfilter.h:296 [inline] ip_local_deliver+0x1ae/0x200 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:454 [inline] ip_sublist_rcv_finish+0x9a/0x2c0 net/ipv4/ip_input.c:580 ip_list_rcv_finish.constprop.0+0x4f9/0x6c0 net/ipv4/ip_input.c:630 ip_sublist_rcv net/ipv4/ip_input.c:638 [inline] ip_list_rcv+0x347/0x4a0 net/ipv4/ip_input.c:673 __netif_receive_skb_list_ptype net/core/dev.c:5525 [inline] __netif_receive_skb_list_core+0x548/0x8f0 net/core/dev.c:5573 __netif_receive_skb_list net/core/dev.c:5625 [inline] netif_receive_skb_list_internal+0x75f/0xdc0 net/core/dev.c:5716 Memory state around the buggy address: ffff88801eb93780: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801eb93800: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc >ffff88801eb93880: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ^ ffff88801eb93900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801eb93980: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller(a)googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches

1 0

[PATCH V9 0/5] ASoC: codecs: Add Awinic AW883XX audio amplifier driver
by wangweidong.a＠awinic.com 13 Jan '23

13 Jan '23

From: Weidong Wang <wangweidong.a(a)awinic.com> The Awinic AW883XX is an I2S/TDM input, high efficiency digital Smart K audio amplifier with an integrated 10.25V smart boost convert Add a DT schema for describing Awinic AW883xx audio amplifiers. They are controlled using I2C v8 -> v9: Delete extra empty lines Use devm_kzalloc instead of kzalloc Structure members applied with devm_kzalloc are not initialized to NULL DAMP is used for power management In Kcontrol, out-of-range values return -EINVAL Delete switch Kcontrol Use devm_snd_soc_unregister_component instead of snd_soc_unregister_component Use aw88395 instead of aw883xx in awinic,aw88395.yaml file Add the sound-dai-cells in awinic,aw88395.yaml file Use unevaluatedProperties: false in awinic,aw88395.yaml file Weidong Wang (5): ASoC: codecs: Add i2c and codec registration for aw883xx and their associated operation functions ASoC: codecs: Aw883xx function for ACF file parse and check ASoC: codecs: Aw883xx common function for ALSA Audio Driver ASoC: codecs: Aw883xx chip register file, data type file and Kconfig Makefile ASoC: dt-bindings: Add schema for "awinic,aw883xx" .../bindings/sound/awinic,aw883xx.yaml | 53 + sound/soc/codecs/Kconfig | 10 + sound/soc/codecs/Makefile | 6 + sound/soc/codecs/aw883xx/aw883xx.c | 579 ++++++ sound/soc/codecs/aw883xx/aw883xx.h | 58 + sound/soc/codecs/aw883xx/aw883xx_bin_parse.c | 1067 ++++++++++ sound/soc/codecs/aw883xx/aw883xx_bin_parse.h | 92 + sound/soc/codecs/aw883xx/aw883xx_data_type.h | 142 ++ sound/soc/codecs/aw883xx/aw883xx_device.c | 1756 +++++++++++++++++ sound/soc/codecs/aw883xx/aw883xx_device.h | 196 ++ .../soc/codecs/aw883xx/aw883xx_pid_2049_reg.h | 383 ++++ 11 files changed, 4342 insertions(+) create mode 100644 Documentation/devicetree/bindings/sound/awinic,aw883xx.yaml create mode 100644 sound/soc/codecs/aw883xx/aw883xx.c create mode 100644 sound/soc/codecs/aw883xx/aw883xx.h create mode 100644 sound/soc/codecs/aw883xx/aw883xx_bin_parse.c create mode 100644 sound/soc/codecs/aw883xx/aw883xx_bin_parse.h create mode 100644 sound/soc/codecs/aw883xx/aw883xx_data_type.h create mode 100644 sound/soc/codecs/aw883xx/aw883xx_device.c create mode 100644 sound/soc/codecs/aw883xx/aw883xx_device.h create mode 100644 sound/soc/codecs/aw883xx/aw883xx_pid_2049_reg.h base-commit: 1f5abbd77e2c1787e74b7c2caffac97def78ba52 -- 2.39.0

4 12